What issues have you encountered this year while recruiting cyber talent, if any?

Security & GRC Talent Sourcing & Hiring

Lack of formal qualifications10%

Lack of available talent48%

Lack of experience21%

Unwillingness to relocate6%

Lack of specific tool/software expertise3%

Unrealistic salary expectations9%

None of the above1%

630 PARTICIPANTS

2.3k views1 Upvote3 Comments

Senior Information Security Manager in Software, 501 - 1,000 employees

When it comes to IT in general, and information security specifically, much of the so-called ‘talent shortage’ is due to companies that do not want to pay for talent.

They offer low-ball salaries/consulting rates and then complain they can’t find people.

https://engineering.tapad.com/the-fallacy-of-the-information-security-skill-shortage-c1214122e6c0

1 2 Replies

Director, Information Security in Education, 1,001 - 5,000 employees

I agree wholly with this. I’m about 8 years into my career and when I first started I would see “entry level positions” with an entry level salary but including a CISSP requirement. I could never figure out if this was HR not understanding that, at a minimum, this requires 4 years of experience to be eligible for or if they knew and were seriously passing off a de facto 4 year experience requirement as entry level.

There are a plethora of people I know wishing to get into the Fidel’s but it’s a combination of poorly written job descriptions and pittance of salaries that are the real cause of a shortage

Director, Information Security in Education, 1,001 - 5,000 employees

Field* not Fidel, haha.

Content you might like

Are short term bans of the use of GenAI applications and tools (such as ChatGPT) a good idea for end users in most organizations? For context see this article on the State of Maine Government's directive before you vote: https://www.govtech.com/artificial-intelligence/chatgpt-generative-ai-gets-6-month-ban-in-maine-government

Applications & Platforms End-User Services & Collaboration People & Leadership +4 more

Yes - Maine did the right thing. There are too many security risks with free versions of these tools. Not enough copyright or privacy protections of data.31%

No, but.... - You must have good security and privacy policies in place for ChatGPT (and other GenAI apps). My organization has policies and meaningful ways to enforce those policies and procedures for staff.52%

No - Bans simply don't work. Even without policies, this action hurts innovation and sends the wrong message to staff and the world about our organization.12%

I'm not sure. This action by Maine makes me think. Let me get back to you in a few weeks (or months).3%

353 PARTICIPANTS

9.3k views9 Upvotes1 Comment

Would anyone be willing to share best practices about how their organization deals with ensuring Cookie Compliance, specifically to GDPR rules? Where should this sort of compliance review sit in an organization? The particular issue we have is who should review new web deployments that use cookies and to make the decisions on whether Cookies are Strictly Necessary or Functionality Cookies. For example is a Cookie required for a Live Chat to work Functionality or Strictly Necessary? Our Security team does not consider taking on these compliance reviews as their domain, as Cookie Compliance is not an internal security matter and the Data Protection team has a limited interest as the GDPR rules around Cookies apply in case of any Cookie being used by a website, whether or not it contains personal data.

Security & GRC Regulatory Compliance

Head of Cyber Security in Manufacturing, 501 - 1,000 employees

I would say, DPO and Security team both shall be involved and work hand in hand.

Most of the time the legals and or DPO don't have the technical acumen to understand when data is floating to third party services.

Lets ...read more

213 views1 Comment

What's your favorite password management service?

Security & GRC Security Operations Center (SOC)Vendor/Product Recommendation +1 more

1Password20%

OneLogin41%

LastPass24%

BitWarden3%

Other (comment below!)12%

331 PARTICIPANTS

1.4k views1 Upvote11 Comments

If you had a magic wand - what's the #1 daily business challenge you'd eliminate?

People & Leadership Strategy & Architecture Cloud +57 more

CTO in Software, 201 - 500 employees

Without a doubt - Technical Debt! It's a ball and chain that creates an ever increasing drag on any organization, stifles innovation, and prevents transformation.

142 19 Replies

Where do HR and other non-security/IT departments fit into your insider risk management strategy/program? What role do they currently play?

Security & GRC Risk Management Threat & Vulnerability Management +1 more

CISO in Software, 10,001+ employees

It is challenging, but sometimes very important for HR to work with IT and Security for scenarios where employees will be laid off, etc. as those people are often higher risk for performing unauthorized or malicious acti...read more